PT-2025-2736 · Venki · Venki Supravizio Bpm

Auber R Maroneze + 2 · Published 2025-01-13 · Updated 2025-10-03 · CVE-2024-46480

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Venki Supravizio BPM versions up to 18.0.1

Description: The issue is related to an NTLM hash leak, which allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system. This can be exploited by attackers to gain higher privileges.

Recommendations: For versions up to 18.0.1, update to a version later than 18.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the Application Administrator role to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2024-46480

Affected Products

Venki Supravizio Bpm

References · 9

• 🔥 https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2024-46480.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-46480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46480 · Security Note
• https://github.com/Lorenzo-de-Sa/Vulnerability-Research · Note
• https://venki.com.br/ferramenta-bpm/supravizio · Note
• https://twitter.com/CVEnew/status/1878892348337160422 · Twitter Post
• https://t.me/cveNotify/137307 · Telegram Post
• https://t.me/cvedetector/15174 · Telegram Post
• https://twitter.com/CveFindCom/status/1878895360745058307 · Twitter Post